[{"data":1,"prerenderedAt":634},["ShallowReactive",2],{"navigation_docs":3,"-concepts-audit-log":183,"-concepts-audit-log-surround":629},[4,25,60,81,153,168],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"icon":6,"path":83,"stem":84,"children":85,"page":6},"API reference","\u002Fapi","4.api",[86,91,96,101,106,111,116,121,126,129,134,139,144,149],{"title":87,"path":88,"stem":89,"icon":90},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":97,"path":98,"stem":99,"icon":100},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":102,"path":103,"stem":104,"icon":105},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":107,"path":108,"stem":109,"icon":110},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":112,"path":113,"stem":114,"icon":115},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":117,"path":118,"stem":119,"icon":120},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":122,"path":123,"stem":124,"icon":125},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":127,"stem":128,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":130,"path":131,"stem":132,"icon":133},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":135,"path":136,"stem":137,"icon":138},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"Overview","\u002Fapi\u002Foverview","4.api\u002F12.overview","i-lucide-layout-dashboard",{"title":145,"path":146,"stem":147,"icon":148,"badge":80},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F13.webhooks","i-lucide-webhook",{"title":80,"path":150,"stem":151,"icon":152,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F14.coming-soon","i-lucide-clock",{"title":154,"icon":6,"path":155,"stem":156,"children":157,"page":6},"Security and licensing","\u002Fsecurity","5.security",[158,163],{"title":159,"path":160,"stem":161,"icon":162},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":164,"path":165,"stem":166,"icon":167,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":169,"icon":6,"path":170,"stem":171,"children":172,"page":6},"Reference","\u002Freference","6.reference",[173,178],{"title":174,"path":175,"stem":176,"icon":177},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":179,"path":180,"stem":181,"icon":182},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":184,"title":56,"body":185,"description":622,"extension":623,"links":624,"meta":625,"navigation":626,"path":57,"seo":627,"stem":58,"__hash__":628},"docs\u002F2.concepts\u002F6.audit-log.md",{"type":186,"value":187,"toc":614},"minimark",[188,201,206,345,348,351,354,457,461,474,478,481,541,544,557,561,592,595,599,610],[189,190,191,192,196,197,200],"p",{},"When someone changes something that matters, Sentinel appends an entry to the audit log: who did it (an API key, ",[193,194,195],"code",{},"sentinel-admin"," or ",[193,198,199],{},"bootstrap","), what they did, to which record, and the details. Regulators and auditors rely on it, so it's built to make tampering obvious.",[202,203,205],"h2",{"id":204},"what-gets-recorded","What gets recorded",[207,208,209,222],"table",{},[210,211,212],"thead",{},[213,214,215,219],"tr",{},[216,217,218],"th",{},"Action",[216,220,221],{},"When",[223,224,225,236,246,263,273,283,296,309,322,335],"tbody",{},[213,226,227,233],{},[228,229,230],"td",{},[193,231,232],{},"alert.updated",[228,234,235],{},"An alert's status or assignee changes",[213,237,238,243],{},[228,239,240],{},[193,241,242],{},"alert.note_added",[228,244,245],{},"A note is added to an alert",[213,247,248,260],{},[228,249,250,253,254,253,257],{},[193,251,252],{},"alert.closure_requested",", ",[193,255,256],{},"alert.closure_approved",[193,258,259],{},"alert.closure_rejected",[228,261,262],{},"Each step of closing an alert",[213,264,265,270],{},[228,266,267],{},[193,268,269],{},"alert.closed",[228,271,272],{},"A screening alert closes by itself because every match was cleared and approved",[213,274,275,280],{},[228,276,277],{},[193,278,279],{},"screening.match_resolved",[228,281,282],{},"Someone records a decision about a screening match",[213,284,285,293],{},[228,286,287,253,290],{},[193,288,289],{},"screening.resolution_approved",[193,291,292],{},"screening.resolution_rejected",[228,294,295],{},"A second person approves a cleared match, or anyone sends it back",[213,297,298,306],{},[228,299,300,253,303],{},[193,301,302],{},"rule.created",[193,304,305],{},"rule.activated",[228,307,308],{},"A rule draft is created or approved",[213,310,311,316],{},[228,312,313],{},[193,314,315],{},"rule.seeded",[228,317,318,321],{},[193,319,320],{},"sentinel-admin rules seed"," installs the built-in rules",[213,323,324,332],{},[228,325,326,253,329],{},[193,327,328],{},"api_key.created",[193,330,331],{},"api_key.revoked",[228,333,334],{},"A key is created or revoked",[213,336,337,342],{},[228,338,339],{},[193,340,341],{},"api_key.bootstrapped",[228,343,344],{},"The bootstrap key is stored on a fresh install",[189,346,347],{},"Each change and its audit entry are written in the same database transaction, so one never exists without the other.",[189,349,350],{},"Events, decisions and screening results aren't audit entries. They're kept in their own tables, which are only ever added to by the API, and each decision stores the rule versions and feature values behind it.",[189,352,353],{},"Each entry has:",[207,355,356,366],{},[210,357,358],{},[213,359,360,363],{},[216,361,362],{},"Field",[216,364,365],{},"Meaning",[223,367,368,378,392,404,417,427,437,447],{},[213,369,370,375],{},[228,371,372],{},[193,373,374],{},"seq",[228,376,377],{},"Position in the log",[213,379,380,385],{},[228,381,382],{},[193,383,384],{},"actor",[228,386,387,388,196,390],{},"The key ID, or ",[193,389,195],{},[193,391,199],{},[213,393,394,399],{},[228,395,396],{},[193,397,398],{},"action",[228,400,401,402],{},"What happened, for example ",[193,403,232],{},[213,405,406,414],{},[228,407,408,253,411],{},[193,409,410],{},"target_type",[193,412,413],{},"target_id",[228,415,416],{},"The record it happened to",[213,418,419,424],{},[228,420,421],{},[193,422,423],{},"data",[228,425,426],{},"The details of the change, as JSON",[213,428,429,434],{},[228,430,431],{},[193,432,433],{},"created_at",[228,435,436],{},"When it was written",[213,438,439,444],{},[228,440,441],{},[193,442,443],{},"prev_hash",[228,445,446],{},"The previous entry's hash",[213,448,449,454],{},[228,450,451],{},[193,452,453],{},"hash",[228,455,456],{},"This entry's hash",[202,458,460],{"id":459},"append-only","Append-only",[189,462,463,464,253,467,196,470,473],{},"Database triggers refuse any ",[193,465,466],{},"UPDATE",[193,468,469],{},"DELETE",[193,471,472],{},"TRUNCATE"," on the audit table. Entries can only be added.",[202,475,477],{"id":476},"hash-chained","Hash-chained",[189,479,480],{},"Each entry's hash covers the previous entry's hash. Change one entry and every later hash stops matching.",[207,482,483,498],{},[210,484,485],{},[213,486,487,490,494],{},[216,488,489],{},"Entry",[216,491,492],{},[193,493,443],{},[216,495,496],{},[193,497,453],{},[223,499,500,513,527],{},[213,501,502,505,508],{},[228,503,504],{},"n − 1",[228,506,507],{},"…",[228,509,510],{},[193,511,512],{},"0a7e19c2…",[213,514,515,518,522],{},[228,516,517],{},"n",[228,519,520],{},[193,521,512],{},[228,523,524],{},[193,525,526],{},"9f2c41b8…",[213,528,529,532,536],{},[228,530,531],{},"n + 1",[228,533,534],{},[193,535,526],{},[228,537,538],{},[193,539,540],{},"e2c97f45…",[189,542,543],{},"The details:",[545,546,547,551,554],"ul",{},[548,549,550],"li",{},"Each hash is SHA-256 over the previous hash and every field of the entry.",[548,552,553],{},"Each field is length-prefixed, so values can't be shifted between fields to forge a match.",[548,555,556],{},"Chains are per organisation and written under a lock, so entries never interleave.",[202,558,560],{"id":559},"verifying-the-chain","Verifying the chain",[562,563,569],"pre",{"className":564,"code":565,"filename":566,"language":567,"meta":568,"style":568},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","sentinel-admin audit verify -org default\n","Terminal","bash","",[193,570,571],{"__ignoreMap":568},[572,573,576,579,583,586,589],"span",{"class":574,"line":575},"line",1,[572,577,195],{"class":578},"sBMFI",[572,580,582],{"class":581},"sfazB"," audit",[572,584,585],{"class":581}," verify",[572,587,588],{"class":581}," -org",[572,590,591],{"class":581}," default\n",[189,593,594],{},"It walks the organisation's chain from the start. If every entry matches it prints how many it checked. Otherwise it reports the first entry that doesn't match and exits with an error.",[202,596,598],{"id":597},"not-built-yet","Not built yet",[189,600,601,602,605,606,609],{},"There's no API or dashboard screen for reading the audit log, and no signed export for auditors. For now, read the ",[193,603,604],{},"audit_log"," table directly and run ",[193,607,608],{},"audit verify",".",[611,612,613],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":568,"searchDepth":615,"depth":615,"links":616},2,[617,618,619,620,621],{"id":204,"depth":615,"text":205},{"id":459,"depth":615,"text":460},{"id":476,"depth":615,"text":477},{"id":559,"depth":615,"text":560},{"id":597,"depth":615,"text":598},"The append-only, hash-chained record of the actions people and keys take in Sentinel.","md",null,{},{"icon":59},{"title":56,"description":622},"LcXu2nfoUaZeGI5Of506lH93So6imPe4QMLcASKL-20",[630,632],{"title":51,"path":52,"stem":53,"description":631,"icon":54,"children":-1},"The people, accounts, devices and agents Sentinel keeps profiles for, and how they connect.",{"title":66,"path":67,"stem":68,"description":633,"icon":69,"children":-1},"What founders, analysts, reviewers, engineers and admins each do in Sentinel.",1792169658428]